Privacy Policy

1. Data controller

The controller of personal data is:

The data controller is the organisation that determines why and how personal data are processed.

2. What personal data we process

We may process the following personal data:

• first name and surname;
• telephone number;
• e-mail address;
• company name, if the person represents a company;
• information the person provides in the contact form or in an enquiry;
• information about the service or project the person is interested in;
• technical information about the website visit, such as IP address, browser, device type, time of visit and cookie data;
• the content of communications, if the person contacts us by e-mail, telephone or other communication channels.

We do not knowingly request or process special categories of personal data, such as health data, political opinions, religious beliefs or other sensitive data. If a person sends such information on their own initiative, we process it only to the extent necessary to handle the specific communication or enquiry.

3. Purposes of personal data processing

3.1. Communication with customers and prospective customers

We use personal data to answer questions, prepare quotations, clarify project requirements and ensure further communication.

Data processed: name, e-mail, telephone, message content, company information.

Legal basis: steps taken at the request of the data subject prior to entering into a contract, or our legitimate interest in ensuring communication with customers and prospective customers.

3.2. Provision of services and performance of contracts

If a person or company becomes our customer, we process data in order to provide services, prepare documents and invoices and ensure project delivery.

Data processed: contact information, contract information, project information, payment and invoicing data.

Legal basis: performance of a contract and compliance with legal obligations.

3.3. Accounting and compliance with legal obligations

We process data that are necessary to comply with accounting, tax and other statutory requirements.

Data processed: name, company details, invoicing data, payment information.

Legal basis: compliance with legal obligations.

3.4. Ensuring the operation and security of the website

We may process technical data to ensure the operation of the website, prevent malicious activity, analyse errors and improve the user experience.

Data processed: IP address, browser data, device data, server log files.

Legal basis: our legitimate interest in ensuring a secure and functioning website.

3.5. Analytics and website improvement

If analytics tools such as Google Analytics or similar solutions are used on the website, we may process visit statistics to understand how users use the website.

Data processed: cookie data, anonymised or pseudonymised visit information, device and browser data.

Legal basis: the person's consent, where the analytics tool concerned is not technically necessary for the operation of the website.

4. Legal basis for processing personal data

We process personal data only where there is an appropriate legal basis for doing so. The Data State Inspectorate states that every processing operation must be based on at least one of the legal bases laid down in the General Data Protection Regulation.

In our case, the main legal bases are:

• the person's consent;
• performance of a contract or steps prior to entering into a contract;
• compliance with legal obligations;
• our legitimate interests, for example ensuring communication, website security and service quality.

5. Personal data retention periods

We retain personal data only for as long as necessary for the specific purpose or as required by law.

Indicative retention periods:

• contact form and e-mail enquiries: up to 24 months after the last communication, if no contractual relationship has been established;
• customer and contract data: for the duration of the contract and thereafter for as long as necessary to protect legal interests;
• accounting documents: for the period laid down by law;
• technical server logs: usually up to 12 months, unless a longer period is necessary to investigate a security incident;
• cookie data: in accordance with the period stated in the relevant cookie notice.

6. To whom personal data may be disclosed

We do not sell personal data to third parties.

Personal data may be disclosed only where this is necessary to provide a specific service or to comply with statutory requirements. Data may be disclosed to the following categories of recipients:

• IT and hosting service providers;
• e-mail and communication service providers;
• accounting service providers;
• legal advisers, where necessary to protect our rights;
• national or local government authorities, where required by law.

Where a service provider processes personal data on our behalf, it acts as a data processor. The processor's obligations towards the controller must be set out in a contract or other legal act.

7. Transfer of personal data outside the European Union

Certain service providers, such as analytics, e-mail or cloud service providers, may process data outside the European Union or the European Economic Area.

In such cases we use appropriate safeguards, such as the standard contractual clauses approved by the European Commission or other valid data protection mechanisms.

8. Cookies

The website may use cookies.

Cookies are small text files that are stored on the user's device. They help ensure the operation of the website, improve the user experience and analyse website traffic.

We may use:

• necessary cookies, which are required for the operation of the website;
• analytics cookies, which help us understand how visitors use the website;
• marketing cookies, if advertising or remarketing tools are used on the website.

Necessary cookies are used without separate consent, as they are required for the operation of the website. Analytics and marketing cookies are used only with the user's consent, where such consent is required.

The user may change cookie settings at any time in their browser or in the cookie management tool available on the website, if one has been implemented.

9. Data subject rights

A person has the following rights:

• to request access to their personal data;
• to request rectification of inaccurate data;
• to request erasure of data;
• to request restriction of processing;
• to object to processing;
• to request data portability;
• to withdraw consent, where processing is based on consent;
• to lodge a complaint with the Data State Inspectorate.

These rights derive from Articles 15–22 of the General Data Protection Regulation, and the Data State Inspectorate describes them as the fundamental rights of the data subject in the processing of personal data.

To exercise their rights, a person may contact us:

We may ask the person to clarify the request or to verify their identity where this is necessary to fulfil the request securely.

10. Lodging a complaint with the supervisory authority

If a person considers that their personal data are being processed improperly, they have the right to apply to the Data State Inspectorate.

The Data State Inspectorate is the Latvian supervisory authority for personal data processing within the meaning of the General Data Protection Regulation.

11. Personal data security

We use reasonable technical and organisational security measures to protect personal data against unauthorised access, loss, disclosure, alteration or destruction.

These measures may include:

• restricting access to data;
• secure server and website configuration solutions;
• use of encrypted connections, where technically possible;
• regular system maintenance;
• control of access rights.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller must notify the Data State Inspectorate without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.

12. Changes to the Privacy Policy

We may update this Privacy Policy from time to time so that it reflects actual data processing, website functionality or changes in legislation.

The current version of the Privacy Policy will always be available on the website nordicrafter.com.